# Filebeat syslog fields are missing in Kibana
**URL:** https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923
**Category:** Beats
**Tags:** filebeat
**Created:** [April 20, 2018, 6:14pm UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923 "2018-04-20T18:14:56Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@yan](https://discuss.elastic.co/u/yan)
#### Post date: [April 20, 2018, 6:14pm UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923/1 "2018-04-20T18:14:56Z")
Hi,
I am running ELK 6.2.4 (Elasticsearch, Kibana and Filebeat) on Centos 7. I see all the logs from /var/log/messages in Kibana "Discover" window, BUT for some reason the syslog fields are missing in the "available fields" list. Can you please point on a possible reason for that ?
I can supply any needed information, when in general I can say that all was configured by the book including:
1. enabling system module
2. filebeat setup
3. ingest-geoip plugin installation
Looks like there is something basic that I am missing.
- Please note that when running ELK on Ubuntu everything worked fine.
I will highly appreciate you assistance.
Thanks,
Yan
---
### Author:  [@simianhacker](https://discuss.elastic.co/u/simianhacker)
#### Post date: [April 27, 2018, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923/2 "2018-04-27T13:47:48Z")
It might be that the field list in the Kibana index pattern needs to be updated. I would first try going to the management app (on the left nav) then clicking on "Index Patterns" under the Kibana subhead. From there click on the name of the index pattern. You should see a group of buttons in the top right hand corner of the screen that looks like:
Click the middle button to "refresh" the fields for that index pattern.
---
### Author:  [@yan](https://discuss.elastic.co/u/yan)
#### Post date: [April 29, 2018, 9:46am UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923/3 "2018-04-29T09:46:53Z")
Ok, I tried that and got the following error:
Any idea what this is about ?
Thanks
---
### Author:  [@simianhacker](https://discuss.elastic.co/u/simianhacker)
#### Post date: [April 30, 2018, 3:13pm UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923/4 "2018-04-30T15:13:17Z")
It looks like you're `.kibana` index is either "Read Only" or you don't have write permissions.
---
### Author:  [@yan](https://discuss.elastic.co/u/yan)
#### Post date: [May 1, 2018, 11:50am UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923/5 "2018-05-01T11:50:27Z")
Ok, I restarted the ELK and eventually managed to do "refresh" per your example above without any errors, but the problem remains. syslog fields are not there.
I am open for any further suggestions.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 29, 2018, 11:50am UTC](https://discuss.elastic.co/t/filebeat-syslog-fields-are-missing-in-kibana/128923/6 "2018-05-29T11:50:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.